ShieldNode : Security layer for AI agent - Designed for AI Agents : API access without your real keys
by•
You hand your AI agents your real API keys, and one leak puts the bill on you. ShieldNode fixes that.
Your agents get a revocable virtual key while your real key stays encrypted in the vault. When an agent asks, you approve or deny from your phone in one tap, with full context: agent, service, key, duration.
✦ Push approval from your phone
✦ Scoped, time-limited virtual keys
✦ Kill any key, or all of them, in one tap
✦ Works with any HTTP API, drop-in skill for any agent
Replies
Hey Hunters,
I'm building of ShieldNode. I built it because I kept hitting the same wall: I wanted to let AI agents call my APIs, but the only options were "paste your real key and pray" or build a solution yourself."
ShieldNode is the security layer between your agents and your real keys. Your agent gets a virtual key while the real one stays encrypted in a vault. You set what it can do (rate limit, allowed endpoints, expiry) and you can kill it in one tap.
The part I'm most excited about is push approval. Leave a key disabled by default, and the moment an agent needs it you get a notification on your phone with full context (which agent, which service, which key, why, duration) and approve or deny in one tap. The iOS and Android apps are live.
There's also an open-source skill so agents like Claude Code, OpenClaw, Codex or Hermes configure all this themselves in one file, and know how to ask for access and back off when you decline.
It's early and I'm specifically looking for builders & users of AI agents. There's a pre-loaded demo service so you're not staring at an empty dashboard & can try it in under 30s. I'd love brutal feedback on the agent workflow especially.
What would make this a no-brainer for how you run your agents?
Just drop the skill to any agent & ask him what he thinks : https://github.com/Dorunaitsu/ShieldNode
Would love to see scheduled access windows on top of the time-limited keys, so I can pre-approve an agent to use a key between, say, 2-4pm for a batch job and have it auto-revoke after. Right now it's just one-off approvals and manual kill, which gets tedious when I have recurring agent runs.
@ilanabak7mvo Great idea, thank you. Keys are already time-limited, so adding a scheduled start is a natural next step, with recurring windows to follow, perfect for cron jobs. Shipping it on the web today / tomorrow, and in the app within the week. I'll ping you right here when it's live :D
The push approval flow feels really solid, especially seeing the exact agent and service requesting access before I tap. Love that I can just nuke a key from my phone if something feels off.
Would love to see per-agent spend caps alongside the time limits, like a virtual key that allows up to X dollars before auto-revoking. That way if a prompt-injection attack slips past approval, the blast radius stays bounded by budget not just duration.